Chapter 4 Protocols key terms

AH (Authentication Header)

In the context of IPSec, a type of encryption that provides authentication of the IP packet's data payload through public key techniques.

ARP (Address Resolution Protocol)

A core protocol in the TCP/IP suite that belongs in the Network layer of the OSI model. ARP obtains the MAC (physical) address of a host, or node, and then creates a local database that maps the MAC address to the host's IP (logical) address.

ARP table

A database of records that maps MAC addresses to IP addresses. The ARP table is stored on a computer's hard disk where it is used by the ARP utility to supply the MAC addresses of network nodes, given their IP addresses.

asymmetric encryption

a type of encryption (such as public key encryption) that uses a different key for encoding data than is used for decoding the cipher text

authentication

the process of comparing and matching a client's credentials with the credentials in a client database to enable the client to log on to the network

CA (Certificate Authority)

An organization that issues and maintains digital certificates as part of the Public-key Infrastructure.

Checksum

A method of error checking that determines if the contents of an arriving data unit match the contents of the data unit sent by the source.

CIA (Confidentiality, Integrity, Availability) triad

a three-tenet, standard security model describing the primary ways that encryption protects data. Confidentiality ensures that data can only be viewed by its intended recipient or at its intended destination. Integrity ensures that data was not modified after the sender transmitted it and before the receiver picked it up. Availability ensures that data is available to and accessible by the intended recipient when needed.

Clientless VPN

A VPN accesses by the client system through a limited, web-based connection using a browser and secured by SSL/TLS

client-to-site VPN (virtual private network)

A type of VPN in which clients, servers, and other hosts establish tunnels with a private network using a VPN gateway at the edge of the private network. Each remote client on a client-to-site VPN must run VPN software to connect to the VPN gateway, and a tunnel is created between them to encrypt and encapsulate data. This is the type of VPN typically associated with remote access.

collision

In Ethernet networks, the interference of one node's data transmission with the data transmission of another node sharing the same segment.

collision domain

The portion of an Ethernet network in which collisions could occur if two nodes transmit data at the same time.

CSMA/CA (Carrier Sense Multiple Access w/Collision Avoidance)

A network access method used on 802.11 wireless networks. CSMA/CA does not eliminate, but minimizes, the potential for collisions

CSMA/CD (Carrier Sense Multiple Access/Collision
Detection)

A network access method specified for use by IEEE 802.3 (Ethernet) networks. In CSMA/CD, each node waits its turn before transmitting data to avoid interfering with other nodes' transmissions

digital certificate

A small file containing verified identification information about the user and the user's public key.

DMVPN (Dynamic Multipoint VPN)

A particular type of enterprise VPN using Cisco devices that dynamically creates VPN tunnels between branch locations as needed rather than requiring constant, static tunnels for site-to-site connections.

dynamic ARP table entry

A record in an ARP table that is created when a client makes an ARP request that cannot be satisfied by data already in the ARP table.

encryption

the use of an algorithm to scramble data into a format that can read only by reversing the algorithm--that is, by decrypting the data--to keep the information private

ESP (Encapsulating Security Payload)

In the context of IPsec, a type of encryption that provides authentication of the IP packet's data payload through public key techniques and encrypts the entire IP packet for added security.

Ethernet II

The most common Ethernet standard today. Ethernet II is distinguished from other Ethernet frame types in that it contains a 2-byte type field to identify the upper-layer protocol contained in the frame.

FTPS (FTP Security or FTP over SSL)

a version of FTP that incorporates the SSL/TLS protocols for added security

Full Tunnel VPN

A type of VPN that captures all network traffic, whether destined for the Internet or for the corporate network.

GRE (Generic Routing Encapsulation)

A tunneling protocol developed by Cisco that is used to transmit PPP data frames through a VPN tunnel. GRE encapsulates PPP frames to make them take on the temporary identity of IP packets at Layer 3. To the WAN, messages look like inconsequential IP traffic.

hop

the trip a unit of data takes from one connectivity device to another. Typically, hop is used in the context of router-to-router communicatios

in-band management

A switch management option, such as Telnet, that uses the existing network and its protocols to interface with a switch.

IPSec (Internet Protocol Security)

A Layer 3 protocol that defines encryption, authentication, and key management for TCP/IP transmissions. IPSec is an enhancement to IPv4 and is native to IPv6. IPSec is unique among authentication methods in that it adds security information to the header of all IP packets.

jumbo frame

A setting on Ethernet network devices that allows the creation and transmission of extra-large frames, as high as 9198 bytes, depending on the type of Ethernet architecture used.

key

a series of characters that is combined with a block of data during that data's encryption

link-layer address

The name for a MAC address on an IPv6 network.

LLC (logical link control) sublayer

a sublayer of layer 2 that is primarily concerned with multiplexing, flow and error control, and reliability

MAC Spoofing

An attack that changes the source MAC address.

MAC sublayer

The lower sublayer of the Data Link layer. Appends the physical address of the destination computer onto the frame.

mGRE (Multipoint Generic Routing Encapsulation)

a tunneling protocol developed by Cisco that allows the configuration of multiple tunnel destinations on a single interface

MTU (maximum transmission unit)

the largest IP packet size in bytes that routers in a message's path will allow without fragmentation and excluding the frame

NDP (Neighbor Discovery Protocol)

A data link layer protocol that works with ICMPv6 to detect neighboring devices on an IPv6 network, helps manage the SLAAC (stateless address autoconfiguration) process, and oversees router and network prefix discovery.

netstat

A TCP/IP troubleshooting utility that displays statistics and the state of current TCP/IP connections. It also displays ports, which can signal whether services are using the correct ports.

out-of-band management

A dedicated connection (either wired or wireless) from the network administrator's computer used to manage each critical network device, such as routers, firewalls, servers, power supplies, applications, and security cameras.

packet sniffer

A software package or hardware based tool that can capture data on a network.

PKI (Public Key Infrastructure)

The use of certificate authorities to associate public keys with certain users.

private key encryption

A type of key encryption in which the sender and receiver use a key to which only they have access. Also known as symmetric encryption.

probe

a repeated trial message transmitted by the tracert and tracert and traceroute utilities to trigger routrs along a route to return specific information about the route. A small electronic device that emits a tone when it detects electrical activity on a wire pair. When used in conjunction with a tone generator, it can help locate the locator. In 802.11 wireless networking, a type of frame issued by a station during active scamming to find nearby access points

protocol analyzer

A software package or hardware-based tool that can capture and analyze data on a network. Protocol analyzers are more sophisticated than network monitoring tools, as they can typically interpret data up to Layer 7 of the OSI model.

Public Key Encryption

A form of key encryption in which data is encrypted using two keys: One is a key known only to a user (that is, a private key), and the other is a key associated with the user and that can be obtained from a public source, such as a public key server. Public key encryption is also known as asymmetric encryption.

RAS (remote access server)

A server that runs communications services enabling remote users to log on to a network and grant privileges to the network's resources.

RDS (Remote Desktop Services)

A service offered by Windows Server that uses RDP (Remote Desktop Protocol) to allow multiple users to access the same virtual or physical Windows Server system at the same time.

Remote Access

A method for connecting and logging on to a server, LAN, or WAN from a workstation that is in a different geographical location.

remote desktop connection

Graphical-based access to a remote computer's desktop.

remote desktop gateway

A service on a Windows server that can manage high volumes of RDP (Remote Desktop Protocol) connections to a network's computers through a single public IP address.

site-to-site VPN

A type of VPN in which VPN gateways at multiple sites encrypt and encapsulate data to exchange over tunnels with other VPN gawteways. Meanwhile, clients, servers, and other hosts on a site-to-side VPN communicate with the VPN gateway

Split Tunnel VPN

A type of VPN that captures only the traffic destined for the corporate network. The client can communicate with local network resources directly and with Internet resources through a local Internet connection.

Spoofing

The act of impersonating fields of data in a transmission, such as when a source IP address is impersonated in a DRDoS attack.

static ARP table entry

A record in an ARP table that someone has manually entered using the ARP utility. Static ARP table entries remain the same until someone manually modifies them with the ARP utility.

symmetric encryption

A method of encryption that requires the same key to encode the data as is used to decode the cipher text.

tcpdump

A free, command-line packet sniffer utility that runs on Linux and other UNIX operating systems.

terminal emulator

Software that allows a user on one computer, called the client, to control another computer, called the host or server, across a network connection.

TFTP server

A file server used to remotely boot devices that don't have their own hard drives, to collect log files from devices, or to back up and update network device configuration files.

three-way handshake

A three-step process in which Transport layer protocols establish a connection between nodes. The three steps are: Node A issues a SYN packet to node B, node B responds with SYN-ACK, and node A responds with ACK.

traceroute

A TCP/IP troubleshooting utility available in Linux, UNIX, and OS X systems that sends UDP messages to a random port on the destination node to trace the path from one networked node to another, identifying all intermediate hops between the two nodes.

tracert

A windows utility that uses ICMP (Internet Control Message Protocol) echo requests to trace the path from one networked node to another, identifying all intermediate hops between the two nodes

VDI (Virtual Desktop Infrastructure)

A remote desktop implementation that offers VM instances for remote access clients.

VNC (Virtual Network Computing)

Software that uses the cross-platform protocol RFB (remote frame buffer) to remotely control a workstation or server.

VPN (Virtual Private Network)

A virtual connection between a client and a remote network, two remote networks, or two remote hosts over the Internet or other types of networks, to remotely provide network resources.

VPN Headend

A VPN gateway that manages multiple tunnels from individual VPN clients.